murmur
This is in unfortunately one of those questions that should be simple to answer for new users but unfortunately, the answer is not just complex but also creates additional questions about how to even use grapheneos. Please note I'm not a security expert, I'm just another user who has tried to piece together things I've read from others over the last few months.
There are several ways people get apps, each with their own use case as well as security and privacy implications.
They are in no particular order:
- Grapheneos apps
- Google Play Store
- Google Play Store with "anonymous" google account
- Google Play Store with "anonymous" account on isolated owner profile
- Aurora Store without a linked Google account
- Aurora Store with a linked Google account
- F-Droid
- Other F-Droid Repositories
- Acresscent
- Direct downloads (like github) using RSS feeds
- Direct downloads using Obtainium
Right off the bat, grapheneos does provide a few apps in its own Apps app. These are designed to work with Grapheneos so install from there if its an option.
As for more comprehensive app sources:
In terms of privacy, F-Droid is often the go-to solution for privacy minded enthusiasts, but there are some security concerns such as the way the official F-Droid repo signs certificates and delays updates. This can be remedied by using different F-Droid Repos instead of the official F-Droid repo such as IzzyOnDroid as well as official repos created by your app's developer (molly, newpipe, etc). There are also concerns about the F-Droid app itself such as it shipping with an outdated version and the official app containing security concerning features. As a result, I see people recommend using "F-Droid Basic" until these issues are resolved in the official app. F-Droid Basic removes or turns off these security vulnerable features.
Even using other F-Droid Repos and using F-Droid basic is still not preferred by some people who instead recommend getting apps directly from the developer (such as their github releases page) instead of from a third-party store. There are two methods for doing this.
The first, slightly outdated way, is to setup RSS feeds on an RSS app like Feeder that track app updates and then manually install updates when they appear on your feed.
The second and more recent elegant approach is to use an app called Obtainium that will both track updates for you as well as let you download and install it directly from the app. You do this by pointing Obtainium to the compatible direct downloads page. The app works mostly seamlessly though I haven't been able to get it to automatically install updates, if this is even a feature. Though I do get notifications when a new update is available.
Unfortunately, these methods have two caveats. The first is that you may need apps that aren't available and the second is it requires you to fully trust the developer without any third-party vetting. If you are a security expert, this might not be a problem. For most people, it's not very practical outside of some hand picked apps. You're also still having to trust a third-party such as trusting github.
In terms of security for most users, Acresscent and Play Store seem to be the best. Acresscent seems to want to create a store that values both privacy and security and I often see others refer to Acresscent as the future go-to app store for degoogled devices. However, right now, there are barely any available apps so it's more of something to keep an eye on but not an immediate solution.
The Play Store using sandboxed play services is the next best option for most people to install known reputable apps from a security standpoint (just because an app is on the play store doesn't inherently make it safe). However, using the play store comes with a privacy cost since even with play services being sandboxed, apps can still bypass thess restrictions by communicating with other apps that allow them to using something called Interprocess Communication (IPC). Since you need to login to a google account, your entire Grapheneos profile will likely be tied to your google account and apps will be able to identify you using this info. (Grapheneos is planning a feature to block/spoof this, but it's still in the works without an expected release date).
There are some workarounds in the meantime. The simplest would be to use the Aurora Store, a third-party front end that gives you access to play store apps without having to install google stuff. However, this lacks some play store security features like Play Protect and also requires you to trust an extra third party. Aurora store also has problems with automatic updates and the app often breaks when not using it with a google account. Conversely, logging into Aurora store with a google account is against Google's terms of service and risks having your account deactivated. Further, not all apps are available such as paid apps and some apps won't work unless they are installed from the actual play store. Grapheneos officially recommends using the official Play Store to install play store apps in their user guide.
The second option is not a real solution, but I'll mention it anyway: using another google account. Unfortunately, this is privacy theater since google will still likely be able to tie that account to you based off other identifiers such as location data, IP address, app installs, payment info, etc. All it takes is one slip up and there are a bunch of ways to accidentally do this when running google services on your main profile, even when sandboxed.
The last option is to use grapheneos's unique user profiles feature. Grapheneos supports installing apps on the owner profile and then pushing these app installs to other user profiles. So on the owner profile with an always on trusted VPN such as ProtonVPN, you install play services on the owner profile and use the play Store with an "anonymous" google account. There are some guides on how to create an account without revealing personal info such as phone number and IP address. Don't use the owner for anything else except to manage app installs with the VPN always running while you use another user account as your main profile. Apps on different profiles can't communicate with each other using IPC. You can even disable the apps you install on the owner profile and they should still get updated on the user profile.
Please also understand that everyone has their own threat model. Some people need absolute privacy and are willing to sacrifice some security and vice versa. Similarly, some people may not want to deal with the inconvenience and simply run everything on the owner profile while logged into the play store just like normal stock. These are decisions you need to make based off your own threat model.